Last updated: September 2026
This Privacy Policy explains how Bisro ("Bisro", "we", "us") collects, uses, stores, and shares information when you use the Bisro mobile application (the "App"). It is written to comply with India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). By creating an account or using the App, you agree to this Policy and to our Terms & Conditions.
1. Two kinds of data, two roles
Bisro is a business tool: shop owners ("you") use it to record their own business information and information about their own customers ("your Customers"). Two different roles apply at the same time:
- Your account data (your name, phone number, password/PIN, business profile) — Bisro is the Data Fiduciary and is responsible to you for this data under the DPDP Act.
- Your Customers' data (names, phone numbers, and ledger balances you enter about people who owe or are owed money by your shop) — you are the Data Fiduciary for that data; Bisro is only your Data Processor, storing and processing it on your instructions. You are responsible for having a lawful basis to record a Customer's personal data in the App and for responding to any request they make to you about it. We will assist you in doing so on request.
2. Data we collect
- Account & identity: full name, phone number, email (optional). Your password and security PIN are stored only as salted cryptographic hashes — never in plain text, and not recoverable by us.
- Business data you enter: shop profile, product catalog, prices, stock levels, sales/billing records, and your Customers' names, phone numbers, and running balances.
- Voice, only when you tap the microphone: the recording is sent to our transcription provider to produce a text transcript, then discarded — the App does not listen in the background, and there is no wake-word or always-on listening (see our Security Policy).
- Photos, only when you choose to scan a handwritten bill or stock list: the image is sent to our AI provider to extract text/amounts for that one request.
- Device & diagnostics: device type, OS version, App version, and basic crash/error logs. The App does not use advertising identifiers, does not show ads, and does not use third-party analytics or ad-tracking SDKs.
We do not collect or store payment card, UPI, or bank account details. Bisro records amounts owed as bookkeeping entries — it does not process payments (see "What Bisro Is Not" in the Terms & Conditions).
3. How your data is used
- To create, secure, and let you sign in to your account.
- To provide the ledger, billing, and inventory features you enter data into.
- To power the "Chinni" AI assistant and the voice/handwriting-scan features, only when you actively use them.
- To send you one-time passwords (OTPs) for sign-up, sign-in, and password reset.
- To detect fraud and abuse and to enforce our Terms & Conditions.
- To comply with legal obligations, including business record-keeping periods required by Indian law.
- To respond to bug reports, feedback, and support requests you submit through the App's Help Center.
We do not sell your data or your Customers' data to anyone, and we do not use it for advertising.
Future AI features: we may, in future, offer additional AI-driven features that analyse your own business data (for example, sales trends or stock suggestions) to give you insights about your own shop. We are not offering this today. Before any such feature goes live, we will update this Policy to name it and describe what it does, and where the DPDP Act requires fresh consent for a new purpose, we will ask for it rather than relying on this paragraph alone.
4. Who we share data with
We use a small number of third-party processors, only for the specific features below. They may not use your data for their own purposes beyond providing that feature to you.
- Google Cloud (Vertex AI / Gemini) — receives your typed or transcribed questions to Chinni, and any photo you choose to scan. Used to generate the AI assistant's replies and to read handwritten bills/lists. This processing currently runs on Google infrastructure outside India.
- An AI transcription service, accessed via OpenRouter — receives voice recordings you make with the microphone button, to convert them to text.
- Sarvam AI — receives text you ask the App to translate.
By using the voice assistant, dictation, handwriting-scan, or translation features, you consent to this transfer outside India, which the DPDP Act permits. If you'd prefer this data not to leave India, don't use those features — manual entry, billing, and ledger management work entirely against our own servers in India and never reach these providers.
WhatsApp reminders: if you choose to send a payment reminder to a Customer via WhatsApp, the App opens WhatsApp directly on your own device with a pre-filled message. Bisro's servers are not involved in sending it, but the Customer's phone number is passed to WhatsApp at that point because that is how the feature works. We do not currently have any SMS gateway or payment gateway integration — no data is shared with a telecom provider or a payment processor by the App itself.
We may also disclose data if required by law, court order, or a lawful government request, or to protect the rights, property, or safety of Bisro, our users, or the public.
5. Your rights under the DPDP Act
As a Data Principal, you can:
- Access a copy of the personal data we hold about your account — contact us using the details in §10.
- Correct or update your account data in-app, under Settings.
- Withdraw consent for a specific feature (e.g. voice, handwriting scan, translation) simply by not using it — the rest of the App keeps working.
- Request erasure of your account (Settings → Delete Account). This schedules deletion after a 7-day recovery window; signing back in during that window lets you cancel it. Once the window passes, we anonymise the fields that identify you (name, phone, email, password, PIN). Ledger and transaction records connected to your account may be retained in de-identified form afterwards, where needed to meet Indian accounting/tax record-keeping periods or to preserve the integrity of other users' ledgers in our B2B network (for example, if another shop's own records reference a transaction involving your account). Erasure removes what identifies you — it does not necessarily remove every record your account ever touched.
- Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
- Raise a grievance with our Grievance Officer (§10). If it isn't resolved to your satisfaction, you may complain to the Data Protection Board of India.
If your request concerns a Customer's data you entered (not your own account), please raise it with the shop owner directly — see §1.
6. Data retention
We keep account data for as long as your account is active, plus the 7-day deletion window above. Security/audit logs are kept for a limited period for fraud and abuse investigation. Voice recordings and scanned images are not retained after their transcript/extraction is produced and returned to your device.
7. Security
See our Security Policy for the technical measures we use. No method of storage or transmission is 100% secure and we cannot guarantee absolute security, but we use industry-standard safeguards, and will notify you and, where the DPDP Act requires it, the Data Protection Board of India, without undue delay if a breach affecting your personal data occurs.
8. Children
The App is intended for business use by adults (18+). We do not knowingly collect personal data from children. If you believe a child's data has reached us, contact us using the details below and we will remove it.
9. Changes to this Policy
We may update this Policy as the App changes. We'll update the date above and, for material changes, notify you in-app before they take effect.
10. Contact us / Grievance Officer
For privacy questions, DPDP Act requests, or grievances, contact us through the App's Settings → Help Center → Report a Bug/Feedback screen, or:
[Grievance Officer name] Bisro — [Registered company legal name] Email: privacy@bisro.in Address: [Registered office address, India]
This section must be completed with a real, named Grievance Officer and company details — as required by the DPDP Act — before this Policy is published.